Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis for iOS and Android

Dynamic Mobile Malware Analysis — iOS and AndroidThis episode expands dynamic malware analysis beyond basic runtime observation and introduces process instrumentation, debugging, network capture, and automated mobile-security frameworks across both iOS and Android.The central idea is:Static analysis tells you what a sample may be capable of; dynamic analysis shows what it actually does when executed.1. iOS Dynamic AnalysisThe iOS portion focuses on three major capabilities: Runtime instrumentation with Cycript Low-level debugging with LLDB Network monitoring with tcpdump + Wireshark 2. Process Injection with CycriptCycript allows researchers to interact with a running iOS process and inspect or manipulate Objective-C objects at runtime.Conceptually:Running Application ↓ Cycript ↓ Attach / Inject ↓ Inspect Runtime Objects ↓ Modify Properties / Invoke Methods ↓ Observe Application Response For example, an analyst can investigate UI objects and modify properties while the application is running.This is useful because it allows researchers to test hypotheses without modifying the original application binary.Possible observations include: UI changes Method execution Object properties Runtime state Application responses to manipulated conditions 3. Runtime InstrumentationThe important concept is instrumentation.Instead of simply watching the application externally, the analyst gains visibility into the application's internal runtime environment.This can help answer questions such as: Which method is being called? What arguments are being passed? Which objects are created? What happens after a specific condition is satisfied? Does the application execute hidden functionality? This makes runtime instrumentation particularly useful when static analysis identifies an interesting function but its actual behavior remains unclear.4. LLDB and Remote DebuggingThe episode then introduces LLDB, a powerful debugger used for low-level inspection.In a controlled research environment, LLDB can allow an analyst to examine: Registers Memory Instructions Breakpoints Program execution Function addresses This provides a significantly deeper level of visibility than high-level instrumentation.5. ASLR and Address CalculationA major challenge during binary debugging is Address Space Layout Randomization (ASLR).ASLR changes where executable components are loaded into memory.Conceptually:Static Binary Address + Runtime ASLR Slide ↓ Actual Runtime Address Therefore, an analyst may need to determine the ASLR slide before translating an address observed during static analysis into the corresponding address in the running process.This is particularly important when setting breakpoints on specific functions.6. Network Monitoring with tcpdumpDynamic analysis isn't limited to the application's process.Network behavior is often one of the strongest sources of evidence.On a controlled research device, tcpdump can capture network traffic into a PCAP file.Conceptually:iOS Malware ↓ Network Activity ↓ tcpdump ↓ PCAP ↓ Wireshark ↓ Traffic Analysis Wireshark can then help identify: Destination IP addresses DNS queries Connection patterns Protocols HTTP traffic Suspicious infrastructure If traffic is unencrypted, analysts may also be able to inspect transmitted content directly.7. Android Dynamic AnalysisThe Android portion focuses heavily on creating a controlled laboratory environment.The primary components are: MobSF Android Studio Android Virtual Devices ADB 8. MobSF — Automated Mobile AnalysisMobile Security Framework (MobSF) provides automated analysis capabilities for mobile applications.For an APK, it can quickly identify artifacts such as: Dangerous permissions Embedded URLs Suspicious strings Application components Security weaknesses Potential indicators of compromise This makes MobSF useful for initial triage.However, automated findings should be treated as leads rather than definitive conclusions.A useful workflow is:APK ↓ MobSF ↓ Automated Findings ↓ Interesting Indicators ↓ Manual Static Analysis ↓ Dynamic Analysis 9. Android Virtual DevicesAndroid Studio's Android Virtual Device (AVD) system allows researchers to create isolated Android environments for testing.A malware-analysis environment should be separated from: Personal devices Production systems Corporate networks Sensitive accounts Important files The purpose is to reduce the consequences of accidental malware execution.10. Android Debug Bridge — ADBADB is one of the most important tools in Android security research.It provides a command-line interface for communicating with an Android device or emulator.Conceptually:Analyst ↓ ADB ↓ Android Device / Emulator ↓ Application / Files / Processes ADB can be used for tasks such as: Installing APKs Removing applications Accessing a shell Transferring files Collecting logs Inspecting the device Debugging applications For example:adb devices can verify that an Android device or emulator is available.An APK can be installed in a controlled lab with:adb install sample.apk 11. Root AccessThe episode also discusses obtaining elevated privileges in an Android research environment.Root access can provide significantly greater visibility into: Application data System files Processes Runtime information Protected directories However, root should be treated as a research capability, not something that should automatically be enabled on production devices.12. Combining Static and Dynamic AnalysisThe most important lesson from the episode is that static and dynamic analysis complement each other.Static AnalysisAnswers:What can this application potentially do?You investigate: Manifest Permissions Strings Classes Functions URLs Libraries Configuration Dynamic AnalysisAnswers:What does the application actually do?You observe: Runtime behavior Process activity Network traffic File modifications API/function execution System changes 13. Complete Mobile Malware WorkflowThe techniques from the entire module can be combined into one investigation pipeline: Malware Sample │ ▼ Initial Triage │ ┌────────┴────────┐ ▼ ▼ iOS Android │ │ ▼ ▼ IPA / Mach-O APK / DEX │ │ ▼ ▼ Static Analysis Static Analysis │ │ └────────┬────────┘ ▼ Behavioral Hypothesis │ ▼ Isolated Lab │ ┌────────┴────────┐ ▼ ▼ iOS Android │ │ Cycript / LLDB ADB / MobSF │ │ tcpdump / PCAP Runtime Logs │ │ └────────┬────────┘ ▼ Network Analysis │ ▼ Behavioral Evidence │ ▼ Final Assessment Key Takeaways Cycript provides runtime interaction and instrumentation capabilities on jailbroken iOS devices. LLDB enables low-level debugging and memory/instruction inspection. ASLR must be considered when translating static addresses into runtime addresses. tcpdump can capture network traffic for subsequent PCAP analysis. Wireshark helps investigate captured communications and identify suspicious infrastructure. MobSF provides valuable automated Android security triage. AVDs provide controlled Android environments for research. ADB is the fundamental command-line interface for interacting with Android devices and emulators. Root access can provide deeper visibility during controlled Android research. Dynamic analysis becomes much more powerful when guided by observations from static analysis. Golden ConceptThe strongest mobile malware investigations use a feedback loop: static analysis generates hypotheses, dynamic analysis tests those hypotheses, and the resulting runtime evidence guides the next round of static investigation. You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy